amazon-managedisapointedmajo8723454.gleeze.com Open in urlscan Pro
137.135.108.55 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://reurl.cc/Qd8pDM
Effective URL:
https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
Submission: On August 03 via api (August 3rd 2020, 6:16:12 am UTC) from CH

Summary HTTP 11 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 7 IPs in 5 countries across 9 domains to perform 11 HTTP transactions. The main IP is 137.135.108.55, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is amazon-managedisapointedmajo8723454.gleeze.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on August 2nd 2020. Valid for: 3 months.

This is the only time amazon-managedisapointedmajo8723454.gleeze.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Amazon (Online)

Domain & IP information

	IP Address	AS Autonomous System
1	35.194.141.193 35.194.141.193	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
2	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1 1	2a00:1450:400... 2a00:1450:400c:c06::9a	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:801::2003	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
4	137.135.108.55 137.135.108.55	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a04:4e42:3::272 2a04:4e42:3::272	54113 (FASTLY) (FASTLY)
11	7

1 35.194.141.193 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 193.141.194.35.bc.googleusercontent.com

reurl.cc	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8012:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c06::9a (Brussels, Belgium) 1 redirects

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 137.135.108.55 (Washington, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

trialteamrediractteamdd.gleeze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
amazon-managedisapointedmajo8723454.gleeze.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a04:4e42:3::272 (Ascension Island)

ASN54113 (FASTLY, US)

m.media-amazon.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	gleeze.com trialteamrediractteamdd.gleeze.com amazon-managedisapointedmajo8723454.gleeze.com	183 KB
2	facebook.net connect.facebook.net	71 KB
2	google-analytics.com 1 redirects www.google-analytics.com	18 KB
1	media-amazon.com m.media-amazon.com	28 KB
1	facebook.com www.facebook.com	268 B
1	google.de www.google.de	106 B
1	google.com 1 redirects www.google.com	183 B
1	doubleclick.net 1 redirects stats.g.doubleclick.net	156 B
1	reurl.cc reurl.cc	1 KB
11	9

	Domain	Requested by
3	amazon-managedisapointedmajo8723454.gleeze.com	trialteamrediractteamdd.gleeze.com amazon-managedisapointedmajo8723454.gleeze.com
2	connect.facebook.net	reurl.cc connect.facebook.net
2	www.google-analytics.com	1 redirects reurl.cc
1	m.media-amazon.com
1	trialteamrediractteamdd.gleeze.com	reurl.cc
1	www.facebook.com	reurl.cc
1	www.google.de	reurl.cc
1	www.google.com	1 redirects
1	stats.g.doubleclick.net	1 redirects
1	reurl.cc
11	10

This site contains links to these domains. Also see Links.

Domain
www.amazon.com

Subject Issuer	Validity	Valid
reurl.cc Let's Encrypt Authority X3	`2020-07-13` - `2020-10-11`	3 months	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-07-21` - `2020-10-12`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-07-07` - `2020-09-29`	3 months	crt.sh
mail.trialteamrediractteamdd.gleeze.com Let's Encrypt Authority X3	`2020-08-02` - `2020-10-31`	3 months	crt.sh
cpanel.amazon-managedisapointedmajo8723454.gleeze.com Let's Encrypt Authority X3	`2020-08-02` - `2020-10-31`	3 months	crt.sh
images-na.ssl-images-amazon.com DigiCert Global CA G2	`2019-10-02` - `2020-10-02`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
Frame ID: 6DF7552B6A50656AD761111447B92B3B
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://reurl.cc/Qd8pDM Page URL
https://trialteamrediractteamdd.gleeze.com/paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf14... Page URL
https://amazon-managedisapointedmajo8723454.gleeze.com/?amz Page URL
https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d Page URL

Detected technologies

Ubuntu (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /Ubuntu/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

78 %
IPv6

9
Domains

10
Subdomains

7
IPs

5
Countries

302 kB
Transfer

541 kB
Size

1
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.amazon.com/ap/forgotpassword?showRememberMe=true&openid.pape.max_auth_age=0&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=5E2S0M02YQK0KWXY6QRW&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Forgot your password?

Search URL Search Domain Scan URL

URL: https://www.amazon.com/ap/register?showRememberMe=true&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.com%2F%3Fref_%3Dnav_ya_signin&prevRID=5E2S0M02YQK0KWXY6QRW&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.assoc_handle=usflex&openid.mode=checkid_setup&prepopulatedLoginId=&failedSignInCount=0&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&pageId=usflex&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0
Title: Create your Amazon account

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://reurl.cc/Qd8pDM Page URL
https://trialteamrediractteamdd.gleeze.com/paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf143kaxsfMdswaSYR1GVOgl6mfPSMEwiTyAxa49xm9491303JWR6iXsxMlkqRCkqdRjYWswjBA%20(1).php Page URL
https://amazon-managedisapointedmajo8723454.gleeze.com/?amz Page URL
https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1628501195&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2FQd8pDM&ul=en-us&de=UTF-8&dt=URL%20Shortener%20-%20reurl&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1671833007&gjid=1787053264&cid=1344970212.1596435355&tid=UA-102456694-1&_gid=1424762278.1596435355&_r=1&z=385795632 HTTP 302
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_gid=1424762278.1596435355&gjid=1787053264&_v=j83&z=385795632 HTTP 302
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_v=j83&z=385795632 HTTP 302
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_v=j83&z=385795632&slf_rd=1&random=3126208907

11 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Qd8pDM Show response
reurl.cc/ 2 KB
1 KB 1128ms
277ms Document
text/html 35.194.141.193
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://reurl.cc/Qd8pDM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.194.141.193 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 193.141.194.35.bc.googleusercontent.com
Software: nginx/1.4.6 (Ubuntu) /
Resource Hash: 2dcb6fafcbd84ff72af5fd3987ad48e2bc796614431c817c665c8ecada3f2b94

Request headers

Host: reurl.cc
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Server: nginx/1.4.6 (Ubuntu)
Date: Mon, 03 Aug 2020 06:15:55 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Content-Encoding: gzip

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 45 KB
18 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/Qd8pDM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://reurl.cc/Qd8pDM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 04 Jun 2020 23:38:14 GMT
server: Golfe2
age: 6134
date: Mon, 03 Aug 2020 04:33:41 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 18469
expires: Mon, 03 Aug 2020 06:33:41 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 134 KB
34 KB 6ms
5ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: reurl.cc
URL: https://reurl.cc/Qd8pDM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/Qd8pDM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 34220
x-xss-protection: 0
pragma: public
x-fb-debug: DIbzfhWx8iIDL5jJMzCsYSeLALrLoA+LTLPCJV/6dwx1LMaLPac3L5cc2zpF9R+j+CW34cnfUEQDp5FasFPTXg==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Mon, 03 Aug 2020 06:15:55 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

ga-audiences
www.google.de/ads/
Redirect Chain

https://www.google-analytics.com/r/collect?v=1&_v=j83&a=1628501195&t=pageview&_s=1&dl=https%3A%2F%2Freurl.cc%2FQd8pDM&ul=en-us&de=UTF-8&dt=URL%20Shortener%20-%20reurl&sd=24-bit&sr=1600x1200&vp=1600...
https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_gid=1424762278.1596435355&gjid=1787053264&_v=j83&z=385795632
https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_v=j83&z=385795632
https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_v=j83&z=385795632&slf_rd=1&random=3126208907

42 B
106 B

17ms
17ms

Image
image/gif

2a00:1450:4001:801::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_v=j83&z=385795632&slf_rd=1&random=3126208907

Requested by

Host: reurl.cc
URL: https://reurl.cc/Qd8pDM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/Qd8pDM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 03 Aug 2020 06:15:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Mon, 03 Aug 2020 06:15:55 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: text/html; charset=UTF-8
location: https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-102456694-1&cid=1344970212.1596435355&jid=1671833007&_v=j83&z=385795632&slf_rd=1&random=3126208907
cache-control: no-cache, no-store, must-revalidate
timing-allow-origin: *
alt-svc: h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1675200226052423 Show response
connect.facebook.net/signals/config/ 151 KB
38 KB 8ms
8ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1675200226052423?v=2.9.22&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

02fe7e165f9f071f36c5ce2c337ef96e987d68d5bff270afb68e89d7a3c57cef

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob:;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .virtualearth.net .google.com 127.0.0.1:* .spotilocal.com: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net .spotilocal.com: wss://.facebook.com: https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://reurl.cc/Qd8pDM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
status: 200
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 38529
x-xss-protection: 0
pragma: public
x-fb-debug: tcZwiSXUOZBRvz3E9eVEYHusJBZRFW3YLO9OWqcuyCDuovr7tjg1xr/xsBmsbLm06WccNzwRXz+Zaxq5D+P99Q==
x-fb-trip-id: 664085054
x-frame-options: DENY
date: Mon, 03 Aug 2020 06:15:55 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
content-security-policy: default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
268 B 6ms
6ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1675200226052423&ev=PageView&dl=https%3A%2F%2Freurl.cc%2FQd8pDM&rl=&if=false&ts=1596435355336&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=28&fbp=fb.1.1596435355335.354631200&it=1596435355314&coo=false&rqm=GET

Requested by

Host: reurl.cc
URL: https://reurl.cc/Qd8pDM

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://reurl.cc/Qd8pDM
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 03 Aug 2020 06:15:55 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 44
expires: Mon, 03 Aug 2020 06:15:55 GMT

GET
H/1.1 200
OK paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf143kaxsfMdswaSYR1GVOgl6mfPSMEwiTyAxa49xm9491303JWR6iXsxMlkqRCkqdRjYWswjBA%20(1).php
trialteamrediractteamdd.gleeze.com/ 125 B
314 B 624ms
126ms Document
text/html 137.135.108.55
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://trialteamrediractteamdd.gleeze.com/paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf143kaxsfMdswaSYR1GVOgl6mfPSMEwiTyAxa49xm9491303JWR6iXsxMlkqRCkqdRjYWswjBA%20(1).php
Requested by: Host: reurl.cc
URL: https://reurl.cc/Qd8pDM
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.135.108.55 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Host: trialteamrediractteamdd.gleeze.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://reurl.cc/Qd8pDM
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://reurl.cc/Qd8pDM

Response headers

Date: Mon, 03 Aug 2020 06:15:55 GMT
Server: Apache
Content-Length: 125
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Cookie set /
amazon-managedisapointedmajo8723454.gleeze.com/ 121 B
484 B 1273ms
771ms Document
text/html 137.135.108.55
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://amazon-managedisapointedmajo8723454.gleeze.com/?amz
Requested by: Host: trialteamrediractteamdd.gleeze.com
URL: https://trialteamrediractteamdd.gleeze.com/paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf143kaxsfMdswaSYR1GVOgl6mfPSMEwiTyAxa49xm9491303JWR6iXsxMlkqRCkqdRjYWswjBA%20(1).php
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.135.108.55 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Host: amazon-managedisapointedmajo8723454.gleeze.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://trialteamrediractteamdd.gleeze.com/paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf143kaxsfMdswaSYR1GVOgl6mfPSMEwiTyAxa49xm9491303JWR6iXsxMlkqRCkqdRjYWswjBA%20(1).php
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://trialteamrediractteamdd.gleeze.com/paypal.com-servicedaccountapps.com-Login.phpsslchanneltruesessionidJwwOGvf143kaxsfMdswaSYR1GVOgl6mfPSMEwiTyAxa49xm9491303JWR6iXsxMlkqRCkqdRjYWswjBA%20(1).php

Response headers

Date: Mon, 03 Aug 2020 06:15:56 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=2dcff134136728e86089364438be4e5f; path=/
Content-Length: 121
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK Primary Request signin Show response
amazon-managedisapointedmajo8723454.gleeze.com/ap/ 8 KB
9 KB 406ms
406ms Document
text/html 137.135.108.55
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
Requested by: Host: amazon-managedisapointedmajo8723454.gleeze.com
URL: https://amazon-managedisapointedmajo8723454.gleeze.com/?amz
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 137.135.108.55 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Apache /
Resource Hash: b73ae741e3a80c4e996b7444a338bd85b2ff42cb997a03aa0bac9b0ea7eb0683

Request headers

Host: amazon-managedisapointedmajo8723454.gleeze.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: document
Referer: https://amazon-managedisapointedmajo8723454.gleeze.com/?amz
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: PHPSESSID=2dcff134136728e86089364438be4e5f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://amazon-managedisapointedmajo8723454.gleeze.com/?amz

Response headers

Date: Mon, 03 Aug 2020 06:15:57 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK main.css
amazon-managedisapointedmajo8723454.gleeze.com/assets/css/ 173 KB
174 KB 108ms
108ms Stylesheet
text/css 137.135.108.55
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://amazon-managedisapointedmajo8723454.gleeze.com/assets/css/main.css

Requested by

Host: amazon-managedisapointedmajo8723454.gleeze.com
URL: https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

137.135.108.55 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Apache /

Resource Hash

c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://amazon-managedisapointedmajo8723454.gleeze.com/ap/signin?session=47c005cc3e875e0e222bf9dd1e3a11bc8298a49d
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 03 Aug 2020 06:15:57 GMT
Origin: https://www.fbi.gov
Connection: keep-alive, Keep-Alive
X_FORWARDED_FOR: 104.16.77.187
X-Forwarded-Proto: https
Content-Length: 177536
X-XSS-Protection: 1; mode=block
Server: Apache
X-Content-Type: nosniff
REMOTE_ADDR: 104.16.77.187
Last-Modified: Fri, 22 Feb 2019 06:33:34 GMT
X-Forwarded-Host: www.fbi.gov
Host: www.fbi.gov
Content-Type: text/css
Referer: https://www.fbi.gov
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98

GET
H2 200 AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
m.media-amazon.com/images/G/01/AUIClients/ 27 KB
28 KB 21ms
6ms Image
image/png 2a04:4e42:3::272
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://m.media-amazon.com/images/G/01/AUIClients/AmazonUIBaseCSS-sprite_1x-c4a765aedd886dc04d89e7e93b6a02c59ecb7013._V2_.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a04:4e42:3::272 , Ascension Island, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5

Request headers

Referer: https://amazon-managedisapointedmajo8723454.gleeze.com/assets/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 03 Aug 2020 06:15:58 GMT
last-modified: Fri, 22 Sep 2017 00:23:19 GMT
age: 11409369
status: 200
x-cache: HIT from fastly, HIT from fastly
content-type: image/png
access-control-allow-origin: *
expires: Mon, 19 Mar 2040 04:59:49 GMT
cache-control: max-age=630720000,public
x-amz-ir-id: e4af3153-f914-4c55-9bfe-53fd16e4fbdd
accept-ranges: bytes
timing-allow-origin: https://www.amazon.com
content-length: 27972
x-served-by: cache-dca17740-DCA, cache-fra19161-FRA

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Amazon (Online)

1 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

number| ue_t0

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			amazon-managedisapointedmajo8723454.gleeze.com/	1969-12-31 23:59:59	Name: PHPSESSID Value: 2dcff134136728e86089364438be4e5f

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

amazon-managedisapointedmajo8723454.gleeze.com
connect.facebook.net
m.media-amazon.com
reurl.cc
stats.g.doubleclick.net
trialteamrediractteamdd.gleeze.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
137.135.108.55
2a00:1450:4001:801::2003
2a00:1450:4001:801::2004
2a00:1450:4001:808::200e
2a00:1450:400c:c06::9a
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a04:4e42:3::272
35.194.141.193
02fe7e165f9f071f36c5ce2c337ef96e987d68d5bff270afb68e89d7a3c57cef
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
2dcb6fafcbd84ff72af5fd3987ad48e2bc796614431c817c665c8ecada3f2b94
437e95a363a4291060e34ba170e043274e0155821e9be374f35de3c4f13cbaa5
b73ae741e3a80c4e996b7444a338bd85b2ff42cb997a03aa0bac9b0ea7eb0683
c53294daa2b521e9c969be5ad264b0c281463b9a9f0fbe341b802d6485a24d19
f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c
fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955

amazon-managedisapointedmajo8723454.gleeze.com Open in urlscan Pro 137.135.108.55 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

11 Requests

100 %HTTPS

78 %IPv6

9 Domains

10 Subdomains

7 IPs

5 Countries

302 kBTransfer

541 kBSize

1 Cookies

2 Outgoing links

Page URL History

Redirected requests

11 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

1 JavaScript Global Variables

1 Cookies

Indicators

amazon-managedisapointedmajo8723454.gleeze.com Open in urlscan Pro
137.135.108.55 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

11
Requests

100 %
HTTPS

78 %
IPv6

9
Domains

10
Subdomains

7
IPs

5
Countries

302 kB
Transfer

541 kB
Size

1
Cookies

11 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!